Cybersecurity & AppSec Track

01 · AppSecLabs S1–S4

Application Security & Exploit Defense

Container & dependency scanners, OWASP Top 10 exploits, secrets management, and WAF hardening.

Stage progress

4 labs in scope

#sec-scanners · S1

1. SAST / DAST & Container Vulnerability Scanner

Simulate Trivy container image scans, Snyk SAST code analysis, and OWASP ZAP DAST web inspection. Identify CVEs, misconfigurations, and dependency risks before they reach production.

Scanner Controls

Select a scanner engine and target to begin vulnerability analysis.

Scanner Engine:

Scan Target / Image / Repo:

Critical findings

2

Triage priority depends on context

High severity

3

Prioritize by exposure and exploitability

Medium severity

2

Review affected path and compensating controls

Low severity

1

Schedule according to risk

Detected findings (8)

Finding ID	Severity	Scanner	Component	CVSS v3.1
CVE-2024-21626	HIGH	Trivy	runc	8.6
CVE-2023-44487	HIGH	Trivy	nghttp2 / Envoy	7.5
DEMO-SAST-001	HIGH	Snyk Code	src/api/auth.ts:42	—
CVE-2024-3094	CRITICAL	Trivy	xz / liblzma	10.0
DEMO-DAST-001	MEDIUM	OWASP ZAP	HTTPS response header	—
DEMO-SAST-002	MEDIUM	Snyk Code	lodash	—
CVE-2023-38545	CRITICAL	Trivy	libcurl	9.8
DEMO-DAST-002	LOW	OWASP ZAP	/search?q=	—

🔬 Finding Details & Fix

CVE-2024-21626 (Trivy)

Leaky Vessels container breakout in runc

Affected:

1.1.11

Remediated:

1.1.12

Description:

In runc 1.1.11 and earlier, a file-descriptor leak can give a container process access to the host filesystem in affected attack paths.

🛠️ Remediation guidance:

Upgrade runc or the vendor-provided container runtime to a patched release; verify the node and image supply chain.

#sec-owasp · S2

2. OWASP Top 10 Vulnerability Matrix & Remediation Lab

Select any OWASP Top 10:2025 category to inspect a display-only teaching scenario, compare vulnerable and remediated code, and identify the relevant defenses.

A01:2025

Broken Access Control

Impact: Data exposure, vertical or horizontal privilege escalation, and unauthorized API actions.

Failures allow unauthorized users to view, edit, or delete data belonging to other users (for example, IDOR and privilege escalation).

❌ Vulnerable ImplementationUNSECURE

// VULNERABLE: Trusting a user-supplied ID without authorization
app.get('/api/invoice/:id', authMiddleware, async (req, res) => {
  const invoice = await db.query('SELECT * FROM invoices WHERE id = $1', [req.params.id]);
  res.json(invoice); // No ownership or role check
});

✅ Remediated Secure ImplementationHARDENED

// REMEDIATED: Enforce authorization for the authenticated principal
app.get('/api/invoice/:id', authMiddleware, async (req, res) => {
  const invoice = await db.query(
    'SELECT * FROM invoices WHERE id = $1 AND owner_id = $2',
    [req.params.id, req.user.id]
  );
  if (!invoice) return res.status(404).json({ error: 'Not found' });
  res.json(invoice);
});

🛡️ Key Architectural Defenses:

•Enforce authorization at the domain/resource layer, not only in the UI
•Deny by default and test both horizontal and vertical access boundaries
•Log access-control failures without recording sensitive payloads

🧪 Display-only scenario tester

Test Request Payload:

Target Handler Mode:

#sec-vault · S3

3. Secret Management Workflow (HashiCorp Vault vs AWS Secrets Manager)

Compare provider-specific secret storage, dynamic credential leases, access policy, and rotation workflows. The controls below are a local simulation.

🔐

HashiCorp Vault

MULTI-CLOUD / ON-PREM

•Key protection: Shamir shares can protect Vault unseal operations; the Transit engine is a separate encryption service.
•Dynamic secrets: A configured database role can issue short-lived credentials, such as a one-hour example lease.
•Authentication: AppRole, Kubernetes, TLS, and other methods are available depending on the enabled auth configuration.

☁️

AWS Secrets Manager

AWS NATIVE

•Encryption: Secrets Manager uses envelope encryption with a 256-bit AES data key protected by AWS KMS.
•Rotation: Managed rotation or a configured Lambda workflow updates both the secret and its target service.
•Access: IAM policies authorize API calls; a VPC endpoint can constrain the network path but is not an authentication method.

Secret Lifecycle Pipeline

Storage & key protection: Encryption details depend on the configured Vault seal/storage and AWS KMS settings. Shamir shares protect an unseal workflow; AWS Secrets Manager uses KMS envelope encryption.

💻 Secret Fetch & Rotation Simulator

Select Provider:

Secret Identifier Path:

Illustrative lease TTL: 3600s

#sec-waf · S4

4. Web Application Firewall (WAF) & TLS Hardening Lab

Configure illustrative request-filtering rules, compare TLS and HTTP-header settings, and inspect a local heuristic. A WAF is not a substitute for secure application code or dedicated DDoS protection.

WAF Rule Table (4 configured rules)

Rule Name	Type	Action	Blocked Hits
OWASP Core Rule Set - SQL Injection	SQLi	BLOCK	1420
OWASP Core Rule Set - Cross Site Scripting (XSS)	XSS	BLOCK	890
Rate Limit: Max 100 Reqs / 5 Min	RateLimit	BLOCK	310
Geo-IP Filter: Block Tor Exit Nodes	GeoBlock	CAPTCHA	145

📡 WAF Live Traffic Tester

Select Traffic Profile:

TLS Hardening & Security Header Checklist

Configure a local teaching heuristic for TLS and response headers; this is not an SSL Labs grade.

Local grade:Grade A+

TLS Protocols & Ciphers:

Enable TLS 1.3 (modern cipher suites provide forward secrecy)Enable TLS 1.2 (select an appropriate forward-secret cipher suite)Enable legacy or weak cipher suites (RC4, 3DES, or unsuitable CBC) - ⚠️ INSECURE

HTTP Security Headers:

Strict-Transport-Security (HSTS max-age=31536000)Content-Security-Policy (example default-src 'self')X-Frame-Options (example clickjacking defense)

Audit Evaluation Result: Local heuristic: selected protocol and header examples are enabled.

02 · IdentityLabs S5–S8

Threat Modeling & Zero Trust Identity

STRIDE threat modeling, least-privilege IAM policies, BOLA/IDOR API security, and Zero Trust boundaries.

Stage progress

4 labs in scope

#sec-threat-model · S5

5. STRIDE Threat Modeling Canvas & Risk Matrix

Select an architecture asset, apply mitigations, and compare the remaining STRIDE findings against risk baselines.

Architecture asset

Public request and application boundary

Applied mitigations

Least PrivilegeAddresses Elevation of privilege.Strong AuthenticationAddresses Spoofing.Input ValidationAddresses Tampering.Object AuthorizationAddresses Information disclosure.Rate LimitingAddresses Denial of service.Audit LoggingAddresses Repudiation.

Web API findings

STRIDE threats ordered by severity.

Residual riskHigh

Risk score18 / 18

Open findings6

High or critical remaining5

Elevation of privilege

criticalOpen

A compromised endpoint may grant actions beyond the caller role.

Control: Least Privilege

Spoofing

highOpen

An attacker may impersonate a caller when identity checks are weak.

Control: Strong Authentication

Tampering

highOpen

Untrusted request data can alter application state.

Control: Input Validation

Information disclosure

highOpen

Overly broad responses can expose data to unauthorized callers.

Control: Object Authorization

Denial of service

highOpen

Unbounded requests can exhaust API capacity.

Control: Rate Limiting

Repudiation

mediumOpen

Without an audit trail, actions cannot be reliably attributed.

Control: Audit Logging

#sec-iam · S6

6. IAM, RBAC & Least Privilege Policy Engine

Build an access request and evaluate it against local role policies, wildcard rules, and MFA condition blocks.

Local policy set

Deny rules are evaluated before matching Allow rules.

6 rules

IAM policy rules used by the evaluator
Effect	Principal	Action	Resource	Condition
Deny	user/*	orders:Delete	orders/*	—
Allow	role/api-reader	orders:Get	orders/*	—
Allow	role/api-reader	orders:List	orders/*	—
Allow	role/ops-admin	admin:*	admin/*	MFA required
Allow	service/orders-worker	orders:Update	orders/prod	—
Allow	role/ops-admin	orders:*	orders/*	MFA required

#sec-api-security · S7

7. Layered API Request & BOLA/IDOR Defense Lab

Test controls that protect an API boundary: identity, object ownership (BOLA), schema validation, and rate limits.

Safe example request

This illustrative request is display-only. The lab never executes entered payload text or sends network traffic.

DISPLAY ONLY

GET /v1/orders/order_2048
Authorization: Bearer <short-lived-token>

IdentityVerified

PayloadSchema-valid

TrafficWithin limit

#sec-zero-trust · S8

8. Zero Trust Micro-Perimeters & Continuous Policy Engine

Model requests using identity, device posture, source zone, destination zone, MFA, and action under continuous verification.

Request path visualization

Static policy stages make the trust boundary explicit before any decision is applied.

Source zoneWorkforceRequest origin

Policy engineEvaluate signalsVerify every signal

Destination zoneDataProtected resource

Current pathworkforce → data · read

Every hop is evaluated with the same signals; being on a workforce or workload network does not grant implicit access.

03 · OperationsLabs S9–S11

Security Operations & Supply Chain

SOC alert triage, incident containment, SIEM detection rules, and CycloneDX/SPDX SBOM audits.

Stage progress

3 labs in scope

#sec-siem · S10

10. SIEM Detection Rules & Log Analysis Lab

Query synthetic authentication, API, WAF, and cloud audit events with correlation rules.

Detection rule

Find events with five or more failed attempts.

Source filter

Severity filter

Structured event stream

Synthetic events only; source addresses use documentation ranges.

8 of 8 events

Synthetic SIEM events filtered by source and severity
Event ID	Source	Severity	Kind / summary	User	Failed	Privilege	Bytes out
auth-001	authentication	high	login-failureRepeated sign-in failures for one account	alex	8	—	—
auth-002	authentication	low	login-successSuccessful sign-in after one retry	morgan	1	—	—
api-014	api	low	token-refreshRoutine service token refresh	service-orders	—	—	0.0 MB
api-033	api	critical	bulk-exportLarge response volume from customer export endpoint	jordan	—	—	1.85 MB
waf-009	waf	medium	blocked-requestBurst of rejected authentication-shaped requests	anonymous	6	—	—
waf-010	waf	low	blocked-requestSingle malformed request blocked at edge	anonymous	2	—	—
cloud-021	cloud-audit	high	role-changeProduction role granted outside maintenance window	sam	—	Yes	—
cloud-022	cloud-audit	low	policy-readRead-only policy inspection	auditor	—	—	0.0 MB

Choose a rule and optional filters, then run detection to see evaluator-matched event IDs and the analyst conclusion.

#sec-supply-chain · S11

11. Software Supply Chain & SBOM Policy Analyzer

Inspect a synthetic package inventory for vulnerability flags, immutable versions, fixture provenance, and license policy before release.

Package inventory

The evaluator re-checks every row whenever the license policy changes.

5 packages

Software bill of materials package inventory
Package	Version	Severity	Fixture attestation	License
express	4.19.2	high	Signed	MIT
lodash	4.17.21	medium	Signed	Apache-2.0
axios	^1.7.2(unpinned)	low	Signed	MIT
internal-plugin	2.1.0	none	Unsigned	Apache-2.0
legacy-parser	1.4.0	none	Signed	GPL-3.0

License allowlist

Only selected SPDX identifiers may ship in this local policy. Toggle a license to re-run the fixture evaluation.

Release policyBlock

BLOCK

6 findings require attention before release.

Evaluator findings

express has a high vulnerability.
lodash has a medium vulnerability.
axios has a low vulnerability.
axios is not pinned to an immutable version.
internal-plugin is not signed.
legacy-parser uses disallowed license GPL-3.0.

Allowlist currently contains 2 of 3 licenses seen in the inventory.

04 · PostureLabs S12–S14

Cloud Posture & Privacy Compliance

Kubernetes pod security admission, multi-control cloud compliance scoring, and data classification.

Stage progress

3 labs in scope

#sec-container-security · S12

12. Container Security & Admission Controller Lab

Model a strict Kubernetes admission policy: non-root users, read-only root filesystems, and dropped Linux capabilities.

Pod security controls

Enable each control that is enforced by your workload policy. Host access controls are secure when their toggles remain off.

Run as non-root userThe workload uses an unprivileged UID instead of root.Read-only root filesystemThe image root filesystem cannot be modified at runtime.Drop Linux capabilitiesUnneeded kernel capabilities are removed from the container.Use host networkingDisabled means the pod remains isolated from the node network namespace.Mount host pathsDisabled means the workload cannot mount arbitrary node filesystem paths.Require a signed imageThe registry signature is verified before the image is admitted.Set CPU and memory limitsThe workload declares CPU and memory limits to bound resource consumption.

Admission decisionRejected

DENY

6 controls failed and must be remediated.

Failed controls

Container must run as a non-root user.
Remediation: Set a pod or image securityContext with runAsNonRoot: true and a non-zero runAsUser.
Container root filesystem must be read-only.
Remediation: Set securityContext.readOnlyRootFilesystem: true and mount explicit writable volumes where needed.
Host networking is not permitted.
Remediation: Remove hostNetwork: true and expose the service through a cluster Service or ingress.
Host path mounts are not permitted.
Remediation: Remove hostPath volumes and use an approved persistent volume or projected secret instead.
Image signature verification is required.
Remediation: Sign the image in CI and configure admission policy to verify its registry signature.
CPU and memory limits are required.
Remediation: Declare CPU and memory requests and limits in the workload specification.

Controls passing1

Controls failed6

Policy modeStrict admission

#sec-cloud-posture · S13

13. Cloud Security Posture Management (CSPM) Scanner

Review a simulated AWS account snapshot across identity, storage, network, logging, and KMS controls.

Posture score

0

Grade F

Open findings

7

Evaluator-calculated risk

Resolved findings

0

Marked fixed locally

Last recalculation

Not run yet

AWS findings (7)

Select a finding to inspect evidence and remediation.

Cloud security posture findings
Control	Finding	Severity
IAM	arn:aws:iam::000000000000:root	critical
S3	s3://acme-prod-invoices	high
VPC	vpc-0f42a1e9 / subnet-07b3c4d1	medium
CloudTrail	arn:aws:cloudtrail:us-east-1:000000000000:trail/example-audit	high
KMS	key/7e6d0d5c-4dcb-4ae5-9a19-prod-data	medium
Security groups	sg-0a8d66bd / prod-postgres	critical
IAM	user/example-deploy / EXAMPLE_KEY_ID	low

#sec-privacy-compliance · S14

14. Data Classification & Privacy Controls Lab

Classify example data assets, inspect mapped protection controls, and complete a privacy readiness checklist.

Example data inventory

Choose a field, then classify it according to its sensitivity and use.

Example fields and data classifications
Field	Example value	Classification
Link activity to a customer account	acct_7F29D1	internal
Send account notifications	alex@example.test	confidential
Reference a vaulted payment method	tok_visa_••••4242	restricted
Display a catalog item	Network Fundamentals	public

Classify email_address

publicinternalconfidentialrestricted

Privacy readiness checklist

Use the checklist to turn classification into operating controls.

0/5 complete

Record the data inventoryName fields, sources, owners, and systems of record.Document purpose and lawful basisTie collection and processing to a documented business purpose.Review access and sharingConfirm least privilege, approved processors, and transfer boundaries.Set retention and deletion evidenceDefine the schedule and retain proof that deletion occurred.Exercise the privacy incident pathIdentify escalation owners and notification decision points.

Enforce policy, inspect exploits & verify posture.

Application Security & Exploit Defense

1. SAST / DAST & Container Vulnerability Scanner

Scanner Controls

Detected findings (8)

🔬 Finding Details & Fix

Leaky Vessels container breakout in runc

2. OWASP Top 10 Vulnerability Matrix & Remediation Lab

Broken Access Control

🛡️ Key Architectural Defenses:

🧪 Display-only scenario tester

3. Secret Management Workflow (HashiCorp Vault vs AWS Secrets Manager)

HashiCorp Vault

AWS Secrets Manager

Secret Lifecycle Pipeline

💻 Secret Fetch & Rotation Simulator

4. Web Application Firewall (WAF) & TLS Hardening Lab

WAF Rule Table (4 configured rules)

📡 WAF Live Traffic Tester

TLS Hardening & Security Header Checklist

TLS Protocols & Ciphers:

HTTP Security Headers:

Threat Modeling & Zero Trust Identity

5. STRIDE Threat Modeling Canvas & Risk Matrix

Web API findings

Elevation of privilege

Spoofing

Tampering

Information disclosure

Denial of service

Repudiation

6. IAM, RBAC & Least Privilege Policy Engine

Local policy set

7. Layered API Request & BOLA/IDOR Defense Lab

Safe example request

8. Zero Trust Micro-Perimeters & Continuous Policy Engine

Request path visualization

Security Operations & Supply Chain

9. Incident Response Lifecycle & SOC Alert Triage

Credential stuffing burst

10. SIEM Detection Rules & Log Analysis Lab

Structured event stream

11. Software Supply Chain & SBOM Policy Analyzer

Package inventory

Evaluator findings

Cloud Posture & Privacy Compliance

12. Container Security & Admission Controller Lab

Failed controls

13. Cloud Security Posture Management (CSPM) Scanner

AWS findings (7)

14. Data Classification & Privacy Controls Lab

Example data inventory

Privacy readiness checklist